Status: Phase 3 second cut — barrel now explicitly names 148 glyphs (the in-use inventory), gating new additions through code review on the single barrel file. The Phase 2 migration sweep (carve-outs → @/components/icons) and the ≤40 curation reduction remain open work, scoped below. Deepens in Phase 5 with branded-wrapper specifications.

Statement

Every icon used in product UI is imported from the curated barrel at src/components/icons. The barrel exposes a bounded vocabulary — Phase 5 cap is ≤40 named exports — chosen for semantic clarity (<Icon.Send> not <PaperPlane>, <Icon.Lock> not <LockKeyhole>) and aligned to Apple HIG / SF Symbols equivalents where one exists. The full lucide-react surface is not part of the product API.

Three carve-outs may continue to import direct from lucide-react, enforced by eslint-rules/no-direct-lucide.cjs:

The barrel itself (src/components/icons/index.ts) — it IS the re-export.
src/components/brand/** — brand glyphs are hand-painted SVG and may compose lucide bases at the metal layer.
src/components/design-system/** — primitives may need the LucideIcon / LucideProps types for icon-slot props.

Why

HIG's equivalent (SF Symbols) ships ~5000 named symbols with weight/scale/variant rules and explicit semantic naming. The cost of that breadth is a centralized catalog — there is one canonical "send" glyph and the platform documents which one to use. Epoch Shield does not need 5000 symbols, but it does need the same single-canonical-glyph property. Without it, three pages can ship three different "send" icons (Send, SendHorizontal, Forward, ArrowRight) and the inconsistency is invisible per-page but cumulatively the app feels uncalibrated.

The barrel + lint rule also gives the design system one chokepoint for:

Globally swapping a glyph in one diff (e.g. flipping every "send" from Send to SendHorizontal).
Introducing brand-painted wrappers (a <Icon.Lock variant="brand"> that paints with the brand gradient) without touching every callsite.
Preventing a fresh page from grabbing an off-vocabulary glyph by mistake.

The audit (Design/0000-hig-diagnostic.md §3.3) flagged the missing barrel as a gap. The barrel now exists; this stub names the contract the barrel curation must honor when the Phase 2 sweep lands.

How

Today (Phase 3 second cut): the barrel at src/components/icons/index.ts explicitly names 148 lucide glyphs — the inventory of every icon actually imported via @/components/icons across src/** (extracted with a multi-line-aware scan that also handles Image as ImageIcon aliases). The blanket export * was retired: adding a new glyph now requires a code-review on this one file (see the file header for the gate criteria). The lint rule epoch-shield/no-direct-lucide remains registered as warn pending the Phase 2 migration sweep.

Phase 2 sweep (the open work):

Inventory. ✅ Done — 111 distinct glyphs in use from the barrel; documented in the barrel's named export list and temp/blockC-icons-clean-*.txt. Direct from 'lucide-react' callsites still exist in 4 carve-out areas (diagnostics, stories, design-system primitives, brand).
Migrate. Replace from 'lucide-react' with from '@/components/icons' at every product callsite (anything outside the carve-outs). Each migrated import must use a glyph already in the curated 111 — otherwise extend the barrel in the same PR with a one-line justification.
Curate down to ≤40. Continuous follow-up after migration completes. Each reduction is its own design call: merge two near-duplicates (Send/Reply in compose contexts), pick one canonical loader (Loader2 vs RefreshCw for spinner state), retire low-value glyphs. Each reduction PR cites this file, names the retired glyphs, and updates every callsite.
Promote. Once Phase 2 migration completes (zero direct-lucide imports outside the four carve-outs), flip epoch-shield/no-direct-lucide from warn to error in eslint.config.mjs. Drive --max-warnings accordingly.

Carve-outs that may continue to import direct from lucide-react (mirrored by eslint-rules/no-direct-lucide.cjs):

The barrel itself.
src/components/brand/** — brand glyphs are hand-painted SVG and may compose lucide bases at the metal layer.
src/components/design-system/** — primitives may need the LucideIcon / LucideProps types for icon-slot props.
src/app/diagnostics/** — internal tooling, not product UI; allowed direct imports until the design-system has a parallel tooling-icon barrel.
**/*.stories.tsx — Storybook fixtures, not shipped product.

Phase 5 maturation:

Branded <Icon> wrapper component that accepts a glyph name + variant (solid / outline / brand) and resolves to the lucide base with appropriate styling.
Per-route icon-usage citations in the Ledger.
Storybook glyph catalog with the ≤40 curated set.

Cross-references

DEC-0022 (HIG alignment) — names HIG iconography as the source of truth for naming.
F-3 (8-color diagnostic palette) — color hooks for icon fills under semantic states.
DEC-0010 (<IconButton>) — every icon used as the sole affordance of a button ships through <IconButton> with required aria-label.

Stop conditions

If the ≤40 cap is exceeded by genuine product need, document each addition in this file with the use case. Drift past 40 should require a principle update, not a quiet PR.
If a callsite needs a glyph the barrel doesn't expose, the work is "add it to the barrel," not "import direct from lucide-react." The lint rule enforces this.
If a brand-painted variant is needed for a glyph (e.g. a brand-gradient lock), it ships through src/components/brand/** and the barrel re-exports the branded version — callsites still import from @/components/icons.